feat(glacier): add new fixer glacier_vaults_policy_public_access_fixer (#5950)

prowler/providers/aws/services/glacier/glacier_vaults_policy_public_access/glacier_vaults_policy_public_access_fixer.py

@@ -0,0 +1,38 @@
+from prowler.lib.logger import logger
+from prowler.providers.aws.services.glacier.glacier_client import glacier_client
+
+
+def fixer(resource_id: str, region: str) -> bool:
+    """
+    Modify the Glacier vault's policy to remove public access.
+    Specifically, this fixer delete the vault policy that has public access.
+    Requires the glacier:DeleteVaultAccessPolicy permission.
+    Permissions:
+    {
+        "Version": "2012-10-17",
+        "Statement": [
+            {
+                "Effect": "Allow",
+                "Action": "glacier:DeleteVaultAccessPolicy",
+                "Resource": "*"
+            }
+        ]
+    }
+    Args:
+        resource_id (str): The Glacier vault name.
+        region (str): AWS region where the Glacier vault exists.
+    Returns:
+        bool: True if the operation is successful (policy updated), False otherwise.
+    """
+    try:
+        regional_client = glacier_client.regional_clients[region]
+
+        regional_client.delete_vault_access_policy(vaultName=resource_id)
+
+    except Exception as error:
+        logger.error(
+            f"{region} -- {error.__class__.__name__}[{error.__traceback__.tb_lineno}]: {error}"
+        )
+        return False
+    else:
+        return True

tests/providers/aws/services/glacier/glacier_vaults_policy_public_access/glacier_vaults_policy_public_access_fixer_test.py

@@ -0,0 +1,81 @@
+from unittest import mock
+
+import botocore
+from moto import mock_aws
+
+from tests.providers.aws.utils import AWS_REGION_EU_WEST_1, set_mocked_aws_provider
+
+mock_make_api_call = botocore.client.BaseClient._make_api_call
+
+
+def mock_make_api_call_public_vault(self, operation_name, kwarg):
+    if operation_name == "DeleteVaultAccessPolicy":
+        return {
+            "ResponseMetadata": {
+                "HTTPStatusCode": 204,
+                "RequestId": "test-request-id",
+            }
+        }
+    return mock_make_api_call(self, operation_name, kwarg)
+
+
+def mock_make_api_call_public_vault_error(self, operation_name, kwarg):
+    if operation_name == "DeleteVaultAccessPolicy":
+        raise botocore.exceptions.ClientError(
+            {
+                "Error": {
+                    "Code": "VaultNotFound",
+                    "Message": "VaultNotFound",
+                }
+            },
+            operation_name,
+        )
+    return mock_make_api_call(self, operation_name, kwarg)
+
+
+class Test_glacier_vaults_policy_public_access_fixer:
+    @mock_aws
+    def test_glacier_vault_public(self):
+        with mock.patch(
+            "botocore.client.BaseClient._make_api_call",
+            new=mock_make_api_call_public_vault,
+        ):
+            from prowler.providers.aws.services.glacier.glacier_service import Glacier
+
+            aws_provider = set_mocked_aws_provider([AWS_REGION_EU_WEST_1])
+
+            with mock.patch(
+                "prowler.providers.common.provider.Provider.get_global_provider",
+                return_value=aws_provider,
+            ), mock.patch(
+                "prowler.providers.aws.services.glacier.glacier_vaults_policy_public_access.glacier_vaults_policy_public_access_fixer.glacier_client",
+                new=Glacier(aws_provider),
+            ):
+                from prowler.providers.aws.services.glacier.glacier_vaults_policy_public_access.glacier_vaults_policy_public_access_fixer import (
+                    fixer,
+                )
+
+                assert fixer(resource_id="test-vault", region=AWS_REGION_EU_WEST_1)
+
+    @mock_aws
+    def test_glacier_vault_public_error(self):
+        with mock.patch(
+            "botocore.client.BaseClient._make_api_call",
+            new=mock_make_api_call_public_vault_error,
+        ):
+            from prowler.providers.aws.services.glacier.glacier_service import Glacier
+
+            aws_provider = set_mocked_aws_provider([AWS_REGION_EU_WEST_1])
+
+            with mock.patch(
+                "prowler.providers.common.provider.Provider.get_global_provider",
+                return_value=aws_provider,
+            ), mock.patch(
+                "prowler.providers.aws.services.glacier.glacier_vaults_policy_public_access.glacier_vaults_policy_public_access_fixer.glacier_client",
+                new=Glacier(aws_provider),
+            ):
+                from prowler.providers.aws.services.glacier.glacier_vaults_policy_public_access.glacier_vaults_policy_public_access_fixer import (
+                    fixer,
+                )
+
+                assert not fixer(resource_id="test-vault", region=AWS_REGION_EU_WEST_1)

tests/providers/aws/services/glacier/glacier_vaults_policy_public_access/glacier_vaults_policy_public_access_test.py

@@ -11,6 +11,9 @@ class Test_glacier_vaults_policy_public_access:
         with mock.patch(
             "prowler.providers.aws.services.glacier.glacier_service.Glacier",
             new=glacier_client,
+        ), mock.patch(
+            "prowler.providers.aws.services.glacier.glacier_client.glacier_client",
+            new=glacier_client,
         ):
             # Test Check
             from prowler.providers.aws.services.glacier.glacier_vaults_policy_public_access.glacier_vaults_policy_public_access import (
@@ -37,6 +40,9 @@ class Test_glacier_vaults_policy_public_access:
         with mock.patch(
             "prowler.providers.aws.services.glacier.glacier_service.Glacier",
             new=glacier_client,
+        ), mock.patch(
+            "prowler.providers.aws.services.glacier.glacier_client.glacier_client",
+            new=glacier_client,
         ):
             # Test Check
             from prowler.providers.aws.services.glacier.glacier_vaults_policy_public_access.glacier_vaults_policy_public_access import (
@@ -89,6 +95,9 @@ class Test_glacier_vaults_policy_public_access:
         with mock.patch(
             "prowler.providers.aws.services.glacier.glacier_service.Glacier",
             new=glacier_client,
+        ), mock.patch(
+            "prowler.providers.aws.services.glacier.glacier_client.glacier_client",
+            new=glacier_client,
         ):
             # Test Check
             from prowler.providers.aws.services.glacier.glacier_vaults_policy_public_access.glacier_vaults_policy_public_access import (
@@ -141,6 +150,9 @@ class Test_glacier_vaults_policy_public_access:
         with mock.patch(
             "prowler.providers.aws.services.glacier.glacier_service.Glacier",
             new=glacier_client,
+        ), mock.patch(
+            "prowler.providers.aws.services.glacier.glacier_client.glacier_client",
+            new=glacier_client,
         ):
             # Test Check
             from prowler.providers.aws.services.glacier.glacier_vaults_policy_public_access.glacier_vaults_policy_public_access import (
@@ -193,6 +205,9 @@ class Test_glacier_vaults_policy_public_access:
         with mock.patch(
             "prowler.providers.aws.services.glacier.glacier_service.Glacier",
             new=glacier_client,
+        ), mock.patch(
+            "prowler.providers.aws.services.glacier.glacier_client.glacier_client",
+            new=glacier_client,
         ):
             # Test Check
             from prowler.providers.aws.services.glacier.glacier_vaults_policy_public_access.glacier_vaults_policy_public_access import (
@@ -249,6 +264,9 @@ class Test_glacier_vaults_policy_public_access:
         with mock.patch(
             "prowler.providers.aws.services.glacier.glacier_service.Glacier",
             new=glacier_client,
+        ), mock.patch(
+            "prowler.providers.aws.services.glacier.glacier_client.glacier_client",
+            new=glacier_client,
         ):
             # Test Check
             from prowler.providers.aws.services.glacier.glacier_vaults_policy_public_access.glacier_vaults_policy_public_access import (